CVE-2026-97045

{
  "etk_id": "ETK-2026-2818",
  "cve_id": "CVE-2026-97045",
  "display_id": "CVE-2026-97045",
  "ghsa_id": "GHSA-vwcj-r8v9-p53f",
  "euvd_id": "EUVD-2026-111400",
  "status": "published",
  "anchor_state": "anchored",
  "title": "HTML namespace confusion in golang.org/x/net/html rendering",
  "summary": "The HTML rendering functionality in golang.org/x/net/html can mishandle nested foreign-namespace content. An attacker who can influence HTML being rendered may cause the resulting markup to be interpreted differently if it is parsed again, potentially leading to injection or inconsistent HTML processing.",
  "mitigation": "Avoid rendering attacker-controlled HTML with the affected component, and do not pass its rendered output to another HTML parser. Monitor the upstream Go security advisory and update to its corrected release when one is identified.",
  "vendor": "golang.org/x/net",
  "product": "golang.org/x/net/html",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.62.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.62.0"
      ],
      "package_name": "golang.org/x/net/html",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.591790933333334,
  "t0_at": "2026-10-27T21:38:56.700000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T21:38:56.700000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T21:38:56.700000+00:00",
      "url": "https://github.com/advisories/GHSA-vwcj-r8v9-p53f"
    }
  }
}